Repository navigation
metafactory_arc: bump to 0.45.0 and install with --frozen-lockfile - #1
Merged
vpzed merged 2 commits intoAug 21, 2026
Merged
Conversation
arc 0.45.0 moved bun.lock out of .gitignore and started tracking it. Until that release a --frozen-lockfile install had nothing to freeze against: it exits 0 and writes nothing, so the flag would have been decoration. Now it is a real gate, and this role is the last install path in the template that resolved arc's dependency tree fresh on every provision. Without the flag the role is a healthy trace over stale input -- the VM reports a pinned arc tag while 28 of its 99 packages float, which is the one-surface drift class the environment contract exists to catch. Both lines move together on purpose: --frozen-lockfile against a tag older than 0.45.0 is a silent no-op, so bumping the version is what makes the flag mean anything. Verified before sending: v0.45.0 exists (6f66aa7) and bun.lock is tracked at that tag (22854 bytes), absent from .gitignore.
This was referenced Aug 20, 2026
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two lines, and they have to move together.
--frozen-lockfileagainst an arc tag older than 0.45.0 is decoration: arc hadbun.lockin its.gitignoreuntil that release, and a frozen install with nothing tracked to freeze against exits 0 and writes nothing. arc 0.45.0 started tracking the lockfile, so the flag is now a real gate.Without it this role is the last install path in the template that resolves arc's dependency tree fresh on every provision — the VM reports a pinned arc tag while its dependency tree floats underneath. That is a healthy trace over stale input, and it is exactly the drift class the fingerprint is there to catch, sitting inside the thing doing the catching.
Verified before sending, rather than assumed:
v0.45.0exists —6f66aa7f31dc831c8373433c36f2bf5cf57e724ebun.lockis tracked at that tag — 22854 bytes, and absent from.gitignoreso the flag will bite rather than no-op.
The comment in
defaults/main.yamlgrew a line because it had become untrue: it said the tag was the verification since there was no separate checksum to pin. From 0.45.0 there is one.Not tested against a live VM from my side — I have no ProxMox host here. It is a version string and a flag, but that is the honest limit of what I checked.